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We investigate the security of continuous-variable (CV) quantum key distribution (QKD) using 
coherent states in the presence of quadrature excess noise. We consider an eavesdropping attack 
which uses a linear amplifier and beam splitter. This attack makes a link between beam-splitting 
attack and intercept-resend attack (classical teleportation attack). We also show how postselection 
loses its efficiency in a realistic channel. 
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Quantum key distribution (QKD) is a technique that al- 
lows two parties, Alice (the sender) and Bob (the receiver), 
^ to share a key which is kept secret from an eavesdropper 
(Eve) who has advanced computational and technological 
power pj. To achieve a signal transmission between dis- 
t-H tant parties, controlling optical quantum states is essen- 
tial. Several QKD schemes based on continuous-variable 
(CV) which uses the quadrature amplitude of light field 
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^ (<^V ) which uses the quadrature amplitude ot 

W been proposed 00,llll@,Slllill3II3 Although 
usage of squeezed states or EPR states are fundamentally 
interesting, coherent-state protocols have practical advan- 
Jp^tage of easy state preparation. CV QKD using coherent 
» states over a lfcm-optical- fiber path has been experimen- 
ts tally demonstrated at 1.55/im-communication wavelength 

O" 1 : The performance of QKD is limited by the presence of 
the transmission loss. A simple treatment of the loss ef- 
. — , feet is beam-splitting attack (BSA) where Eve replaces the 
transmission path with the lossless one and a beam splitter 
J-j (BS). Then she obtains the signals corresponding to the 



loss without making any disturbance to the signal. At first 
sight, over the existence of 50% loss (3dB loss), it seems to 
be impossible to distill the secret key using coherent-state 
signal because Eve can get stronger signal than Bob 0. 
However, since the knowledge about the signal depends 
on the measurement result, coherent-state protocol can 
provide a secure key by conditional use of measurement 
results (postselection, PS) even in the presence of higher 
loss H,[ni[u|- PS plays an important role in many im- 
plementations of quantum information processing tasks as 
well as QKD. 

In realistic condition, besides the loss, excess Gaussian 
noise is imposed on the quadrature distribution |lfj| . Since 
any excess noise tapers off when the state falls into vac- 
uum at high loss, the excess noise added by Eve near Al- 
ice's side will disappear at Bob's side for a long trans- 
mission distance. Then, for a sufficiently long distance, 
eavesdropping cannot be detectable. From this observa- 
tion, it is shown that CV-QKD protocols using coherent 
states cannot work for arbitrary transmission distance in 



the presence of excess noise 12]. This limitation is given 
by an intercept-resend attack called classical teleportation 
attack (CTA). 

The question is what kind of attack links between "di- 
rect" CTA and "indirect" BSA, and how PS works in the 
presence of excess noise. In this Letter, we provide an in- 
termediate attack between BSA and CTA, and show how 
PS loses its advantage in the presence of noise. 

We consider the realistic channel which transforms co- 
herent state into a Gaussian mixture of coherent states as 



\a) -> p(a,r),S) 
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\^ja + l3)(^ja + P\d 2 f3, 

where r\ is the line transmission and S is quadrature ex- 
cess noise. Coherent state is eigen state of a: a\a) = a\a). 
We define quadrature amplitude Xi, £2 by the relation 
a = x\ + 1x2- a is the annihilation operator of signal pulse 
mode. The quadrature variance of coherent state is given 
by (Ax) 2 — j. As a frame work, we assume that all noise 
is caused by Eve in the quantum channel and Bob has 
an ideal detector. Then, for coherent-state input to the 
channel |JT]|. Bob observes Gaussian quadrature distribu- 
tion PJI and the observed quadrature variance (Ax bs) 2 
is related to the excess noise as 



(Ax bs) 2 = (l + S)(Ax) 2 



(2) 



Bob's mean values of quadratures can be related to the 
transmission and coherent-state amplitude as 



(Xi) + i(X2) 



y/rja. 



(3) 



In terms of S and 77, the limitation given by CTA is S < 1r\. 
We refer to it as classical teleportation limit (CTL) fl2| . 

Some of eavesdropping attacks which cause the state 
change Q can be constructed by combining BSs and 
phase- insensitive amplifiers (AMP). Simplest case is that 
Eve uses only one BS and one AMP. If Eve uses the Ampli- 
fiers after the BS, Eve's and Bob's quadratures are mod- 
ulated independently. Thus the results of Bob's quadra- 
ture measurement and Eve's state are not correlated, and 
the effectiveness of PS is inherently different from that 
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FIG. 1: Eve uses a beam splitter (BS) with transmission k 
after performing a phase-insensitive amplifier (AMP) with am- 
plification gain g. (3 is amplification noise. 



we call amplification-beam-splitting attack (AMPBSA) 
where Eve inserts BS after AMP (see FIG.Q}. 

Let us assume that Eve operates a phase-insensitive am- 



plifier with amplifier gain g > 1 and inserts a BS with 
reflectivity 1 — K (see Fig. H). Then g and n are related 
to Bob's mean value and variance of quadratures as 



+ i{x 2 ) 

(AXobs) 2 



/gKa, 

{2(g-l) K +l}(Ax) 2 . 



Using Eqs. ©, © and ©, we obtain 



77 — 5/2. 



(4) 
(5) 



(6) 
(7) 



From Eq. ©, we can see that BSA (5 = 0) is the unit 
gain case: g = 1, and CTL (5 — > 2rj) is relevant to the 
infinite-gain limit: g — > 00. 

Provided Alice sent Eve's operation makes the joint 
state of Bob and Eve: 



|0)j 



Pbe{u,t],5) = — 



\Vva + l3}B(Vva + P\® £(yV 



d 2 f3, 



(8) 



r 



where we defined 



/l - 77+ 5/2 



r/ - 5/2 



(9) 



The subscripts B and E stand for Bob's and Eve's system, 
respectively. We can easily see that Tie (pbe) — p(cv, 77, 5) 
where Tr^ is partial trace of Eve's system. 

The form of pbe shows that Eve receives |£(v^? a + P)) 
when Bob receives \y/fja + (3) i.e., the coherent state Eve 
receives is different from that of Bob's only by the ampli- 
tude factor £ for each transmission. This simple picture 
is useful to explain (i)CTL and (ii)3dB loss limit as 
follows: 

(i) If £ becomes infinity (5 — > 277 or g — > 00), Eve can 
read out the coherent-state amplitude y/fja + f3 with arbi- 
trary resolution by performing simultaneous measurement 
of quadratures. In other words, she can determine the 
state Bob receives \y/rja + (3) or she can produce infinite 
number of copies of this state. This condition is equivalent 
to the case of intercept-resend attack, and it demonstrates 
CTL. 

(ii) A sufficient condition for secure key distribution 
against individual attack is 



Iab > Iae, 



(10) 



where Iab ( A fa is Mutual information between Alice and 
Bob (Eve) [3, Ej, EL F° r Gaussian continuous key distri- 
bution protocols [a, > the Mutual information is directly 
related to the signal-to-noise ratio (SNR); the higher is 
the SNR, the higher is the amount of mutual information 
between the parties. The case £ < 1 means Bob's SNR is 
higher than that of Eve because in Eq. (jHJ Bob's coherent- 
state amplitude is larger than that of Eve's. Thus, the 
security condition given in (|1L)|) is written as 



If 5 = 0, we obtain a reduced condition 77 > 1/2 which 
gives the 3dB loss limit. This analysis excludes reverse- 
reconciliation protocol of 0. 

Now we go into the security of PS protocol against 
AMPBSA. In the postselection protocol , a mea- 

surement result x higher than a given threshold xq > is 
selected to distil the secret key. By setting xq higher, bit- 
error rate (BER) of Bob can be arbitrary small provided 
the quadrature distribution is Gaussian. In contrast to 
this, if Eve's signal is independent of x, Eve's BER re- 
mains constant under PS. So PS can make information 
advantage for Bob compare to Eve. This is not the case 
for AMPBSA. In Eq. ©, the modulation (3 is added to 
both of Eve's and Bob's systems collectively. Through f3, 
Eve's state depends on x and then Eve's BER depends 
on PS. So the correlation between Bob's and Eve's state 
given by (3 weakens the PS advantage. 

Let us consider the case that Alice sends binary-phase- 
shiftcd coherent states |±a) with a > and Bob performs 
quadrature measurement on the correct basis X\ [ill Il2|. 
To describe the postselection events, we use Eve's density 
operator conditioned on Bob's measurement result x. If 
Alice sent |a) and Bob observed x, Eve's density operator 
(conditioned on x) is given by 

s ( 1 s Tr B (pBE(a,V,S)\x) B (x\) , , 

PE(a\x) = , (12) 



where 



B[x\a) 



Pb{x\o) 

Tr(/5 BB (a,77, S)\x) B (x\) 
(x\p(a,rj,6)\x) 



(13) 

is the probability that Bob gets quadrature value x. 

Since Eve does not know the sign of x, we can estimate 
Eve's information from the density operator conditioned 
on the absolute value of x: 



F < 1 



mi 



nn(r\\\a-X\ — P ( rr\ t.} n & ( rv\ x) + P(rv\ — T.}n^(rv\ — xfilA) 



3 



where we define the probability that Alice's choice is \a) 
when Bob gets x: 



P{a\x) = 



P B (x\a) 



P B (x\a) + P B (x\-a) 



(15) 



Therefore, if Bob's measurement result is ±x, Eve gets 
either of the two mixed states p£;(±a||x|) corresponding to 
Alice's choice |±a), respectively. The next problem is how 
Eve differentiates the given two signal p E (+-Ot\ \x\). In gen- 
eral Eve may choose her measurement knowing the value 
\x\. Here we restrict our analysis for the case that Eve 
performs quadrature measurement and determines the bit 
value according to the sign of her measurement result Xe 
as Bob does. In this case she does not use the information 
of |x|. 

For the PS protocol, Mutual information is written as 



I 



AB(B) = g P B{x)i{<lB(E){x)), (16) 

|x|>x 



where 



Pb{x) = ^(P B (x\a) 



P B {x\-a)) 



(17) 



is the probability that Bob's measurement result is x, 



i(q) = 1 + <?log 2 q+(l-q) log 2 (l - q) 



(18) 



is Mutual information of binary symmetric channel, and 
Qb(e)(x) is BER of Bob (Eve) conditioned on |x|. Since 
i(q) is a decreasing function of q (0 < q < |), q B (x) > 
q E (x) for any x implying that any conditional use of mea- 
surement result does not satisfy inequality 1)10(1. 

Eve's BER conditioned on |x| is the probability that the 
signal is pe(— &\ \x\) when the sign of Eve's measurement 
result xe is positive: 



J °° (xe I pe ( - a 1 1 x | ) | xe ) dxi 



Jo ((x E \p E (-a\\x\)\x E ) + (x E \p E (a\\x\)\x E )) dx E 

^P(a\x) crfc (V2\(Sx + y/rja)\ + )-P(-a\x) erfc (V2X(5x - y/rjafj , 

I 



(19) 
(20) 



where we use the definition of p BE 0, Eqs. 1121 - 114(1 . 

and quadrature distribution of coherent state |(x|a)| 2 = 
^2j^ e -2(x- a ) 2 ^ and we define erfc^) = 2/0f e -* 2 dt 

and 



' (l-v) + 6/2 

( v + s/2)(i + sy 



(21) 



In what follows we set x > for simplicity. 



For sufficiently large x, qE is bounded above as 



<1E 



(x, 77, 6) = ^P(a\x) crfc (V2X(Sx + ^/rja)^j + ^P(-a\x) erfc (V2X(Sx ~ yjrja) 

< - I crfc (y/2X(Sx + ^/rjafj + erfc (V2X(6x - yV)) } 

< erfc (V2X(8x - y/rja^j 

' -2\ 2 (5x- ^/rja) 2 _ \ -2A 2 (8 2 x 2 -2^/rjaSx+na 2 ) 



< 



< 



e -2\ 2 V a 2 



-X 2 S 2 x 2 



(22) 



r 



The first inequality comes from the fact P(±a\x) < 1. 
The second inequality comes from the fact erfc(s) is a de- 
creasing function of s with X(Sx — ^Jrja) < X(5x + ^Jrja). 

Then, we use an inequality v / 7rerfc(s)/2 = / s °°e~* 2 dt < 
j°° te~ l dt = e~ s /2 for s > 1 assuming x is large enough 
so that \/2X(Sx — y/7ja) > 1, which gives the third in- 
equality. Further assuming x > we obtain the 
final expression. 

Rnh's RFT? rnnrlitinnrrl nn Ifl is thr rnnHitinnfll nrnha.- 



bility that the sent state is | — a) when his measurement 
result x is positive: 



q B (x,r),S) = P(-a\x) 



1 



1 + cxp 



S^/fjax 
l+S 



(23) 



Since q B ~ exp (— x^J and q B < e A s x from ex- 

nrpssinn (1^1 fnr a.nv p'iven 8 ~> fl tlnrrr exist siiffiripnt.lv 
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large x where qE < qs holds. In such a condition, simple 
PS setting higher threshold is no more advantageous. It 
will be more efficient to discard higher quadrature value. 
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FIG. 2: The security condition Iab > Ie cannot be sat- 
isfied above the line for mean photon number n = a 2 — 
O.OOf, O.Of, O.f, f, fO by any postsefection of quadrature mea- 
surement. For continuous-gaussian-key-distribution protocol 
the condition can be satisfied below the line £ = 1. S < 2rj 
is a necessary condition for any coherent-state-QKD protocol 
given by an intercept-resend attack |T^|. 



Figure [21 shows, the parameter region of rj and S which 
satisfies qE < qs for any choice of x for several mean pho- 
ton number n = a 2 . This means, above the line, any kind 
of PS cannot achieve Iab > Iae- We can see that larger 
n seems to be more tolearant to noise. This is because, for 
a given S, if n is larger the effect of collective noise is rel- 
atively smaller. It should be noted that choice of large n 
results much smaller secure key gain for higher loss owing 
to BS A ^3 • The estimation of secure key gain with some 
optimization of both Eve's measurement and PS strategy 
is left for full paper. 

In this analysis we assume an ancillary system of am- 
plifier is just traced out (See Fig. 1). It is likely that 
the ancilla provides some useful information for Eve. In 
this sense AMPBSA may be weak attack. The condi- 
tion where Eve cannot access the ancilla can be realized if 
Alice sends thermal coherent states p(a, l,r]S) instead of 
coherent states and Eve performs just BSA. This case the 
density operator of joint system is described by Eq. (JSJ 
with the replacement £ — > y(T— rjj/rj. 

In conclusion, we have investigated the security of CV 
QKD using coherent states against amplification-beam- 
splitting attack. This attack makes a link between "di- 
rect" classical-teleportation attack and "indirect" beam- 
splitting attack. It has been shown that the postselection 
protocol setting higher threshold need not ensure the se- 
curity in the presence of excess Gaussian noise. 

We thank M. Koashi for helpful discussions. 
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